From another perspective, this could be useful in DFIR cases, to target response "packs" at only the systems in scope of the incident being investigated.

Perhaps you could use labels for this ?